Vikunja Path Traversal in PluginsDir and LogPath

Executive Summary

Vikunja before version 2.7.1 fails to properly anchor the Plugin and Log directories to the service rootpath. This means plugins can load from and logs can be written to the startup working directory instead of the intended rootpath. Local attackers with write access to this directory could exploit this to plant malicious plugins or read sensitive logs like audit.log.

Useful 0 Not Useful 0

Detection Guidance

Check if Vikunja is running from a non-packaged deployment with plugins enabled. Inspect the startup working directory for unexpected plugin files or logs, especially audit.log outside the intended rootpath. Verify if PluginsDir and LogPath are correctly set to the rootpath and not resolving to the working directory.

Useful 0 Not Useful 0

Impact Analysis

If you run Vikunja in a non-packaged deployment and start it from a directory other than the rootpath, local attackers with write access to the startup directory could inject malicious plugins or access sensitive logs. This requires local access and has high attack complexity, limiting the impact to confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later to address the path anchoring issue. For non-packaged deployments, ensure the startup working directory is secure and plugins are disabled unless necessary. Review directory permissions to prevent unauthorized write access.

Useful 0 Not Useful 0